Security teams should use one risk model for both people and AI agents, because both can hold identity context, permissions, and access to data. The goal is to score behavior, identity, and threat signals together, then focus intervention on the small set of accounts driving most exposure. This gives leaders a single view of risk instead of fragmented reports.
Why This Matters for Security Teams
Human users and AI agents can both initiate actions, reach sensitive systems, and create material exposure when their identity context is too broad or too loosely governed. Treating them as separate risk problems usually leaves blind spots: people are scored in one tool, agents in another, and neither view captures how permissions, prompts, tokens, and business workflow combine. Current guidance from the NIST Cybersecurity Framework 2.0 supports unified governance across assets, identities, and operational risk, which is the right direction for mixed human and machine workforces.
The practical issue is not whether an AI agent is “a user” in the classic IAM sense. The issue is whether it can be trusted to act with the right scope, for the right purpose, and under the right monitoring. That requires one operating model for identity assurance, entitlement review, anomaly detection, and intervention thresholds. Security teams that separate human and agent oversight often miss the shared failure mode: overprivileged access combined with weak behavioral review. In practice, many security teams encounter this only after a privileged workflow has already been abused, rather than through intentional joint risk design.
How It Works in Practice
A unified model starts by defining a common risk record for every actor that can execute actions or access data. For humans, that record includes authentication strength, role, device posture, access history, and unusual behavior. For AI agents, it includes model provenance, tool permissions, prompt and context boundaries, token handling, and the human or system owner responsible for the agent. The intent is to compare like with like at the decision layer, even if the identity technology behind each actor differs.
Security teams usually get better outcomes when they normalize risk signals into shared categories such as privilege, sensitivity, autonomy, and exposure. That allows policy to answer the same questions for both groups: what can act, what can it touch, how far can it go, and what should happen when risk rises. This is consistent with the NIST AI Risk Management Framework, which emphasizes governance, mapping, measurement, and management rather than isolated technical controls. For agentic systems, teams should also align threat modeling with the OWASP Agentic AI Top 10 and the MITRE ATLAS adversarial AI threat matrix.
- Assign each human and agent a risk owner, not just an account owner.
- Map entitlements to business-critical actions, not only to directory groups.
- Score behavior using shared signals such as unusual access, data movement, and policy violations.
- Set intervention paths that scale from step-up review to suspension of a token, tool, or session.
- Review both actor types in the same governance forum, even if evidence sources differ.
The model works best when agents are treated as governed execution identities with explicit boundaries, logging, and revocation paths. These controls tend to break down in fast-moving environments where agents can create new workflows, call external tools, or inherit permissions from chained automation without a clear ownership boundary.
Common Variations and Edge Cases
Tighter unified control often increases operational overhead, requiring organisations to balance faster automation against stronger review and approval paths. That tradeoff becomes visible when teams try to apply one scoring method to both highly interactive employees and autonomous agents with very different blast radii. Best practice is evolving, and there is no universal standard for this yet, especially for agent autonomy tiers and cross-system risk aggregation.
Some environments need separate thresholds even if they share one model. For example, a customer support agent with read-only access and low autonomy may tolerate a different trigger level than an AI agent with write access to production systems. Similarly, a human in a break-glass role may need temporary exceptions that should not be copied to an agent. The key is to preserve one governance language while allowing different control responses by actor type. The emerging consensus from sources such as the CSA MAESTRO agentic AI threat modeling framework and the Anthropic report on AI-orchestrated cyber espionage is that autonomy, tool access, and context inheritance need explicit governance, not informal trust.
For identity-heavy organisations, the strongest programs also align this work with control baselines such as NIST SP 800-53 Rev 5 Security and Privacy Controls. The practical takeaway is simple: unify the risk language, but do not pretend humans and agents fail in exactly the same way. The control objective is comparable visibility, not identical treatment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC, PR.AC | Unified actor risk needs governance plus access control across people and agents. |
| NIST AI RMF | AI RMF fits shared measurement and management of AI agent risk. | |
| OWASP Agentic AI Top 10 | Agentic AI risks like tool abuse and prompt injection affect the unified model. | |
| MITRE ATLAS | ATLAS helps model adversarial tactics against AI agents and their workflows. | |
| NIST SP 800-53 Rev 5 | AC-2, AC-6, AU-2 | Account lifecycle, least privilege, and auditing support shared human-agent controls. |
Define one governance model and apply least-privilege access reviews to both human and AI actors.
Related resources from NHI Mgmt Group
- How should security teams detect attacks that move across human, NHI and AI agent identities?
- How should security teams evaluate AI-powered human risk management tools?
- How should security teams implement an AI risk management framework across discovery, policy, and monitoring?
- How should security teams decide whether an AI agent gets human or non-human identity?
